A side effect of the merge of the bundle checking code with the new sun.jkernel.Bundle class disabled checking, because the sense of the securityEnabled field initialization is backwards. All of the actual security code in method download(boolean) had been tested before the merge and was cut/pasted into the new Bundle class without modification. However final tests were all run with good bundles and so this error wasn't discovered until investigation of 6595104 started.